Designing a role based system with more granularity

Question

I am designing a resource request system where an user can request resource of different types. There can be many resource types such as:

1. VM
2. DB
3. File System
4. etc

Above types can have sub-types and i.e. there can be mysql, postgresql etc for resource type of DB. The user can have different roles like:

1. Director
2. Manager
3. Employee

Use Cases

A director can request any resource on behalf of any manager and its cost centre.

A manager can request any resource oh behalf of any of his cost centres.

An employee can request only those resource which is allowed by his manager.

Implementation:

For director is very easy since there is no check in the system. For manager and user I have a many to many relationship between resource type and user entity

Question:

I see that the system needs Roles and Permissions but by using these I can establish some generic rules such as the user assigned the Reporting role can see the reports, but how to manage more granular level of permissions like a given user can only request only a given resource?

Answer 1

The right move here is to separate the two concepts. You have roles with a list of permissions, and then you have a sort of whitelist implementation where a given user can only access specific resource or resource types.

So first step, define a list of permissions, which is to say, all the possible things a user could be able to accomplish. In your specific case, I think these would suffice:

1. Can request resource on behalf of Manager.
2. Can request resource on behalf of his cost centre.
3. Can request resources allowed by whitelist.
4. Can request any resource.

Your director role would have 1, 2, and 4. You could possibly add 3 as well so long as you first check existence of 4 (in other words if written properly, you should never lose functionality in your program by adding a permission).

Your manager role would just have 2 and 4. Your employee role would have, you guessed it, just 3.

So what happens when you get a role with no permissions? A role with no permissions is the maximum allowable features you allow for someone with no authorization (aka a guest) and it is correct that this is the default behavior from a security standpoint.

Right, now you have permissions. Now all you have to do is implement the whitelist. The whitelist just guarantees that a given employee can access a given resource. Forget permissions for a second and focus on this simple task.

Once you have both, you need only add a switch in your code to change behavior like:

If user has permission 4:
   return getResource(resource)
Else if user has permission 3 and hasAccess(user, resource):
   return getResource(resource)
Else:
   throw new ResourceInaccessibleException();

The trick is just making a distinction between permission and checks performed with or without said permissions. Using a role/permission pattern like this is also very flexible for you in the future.